CVE-2026-89156

What it actually does

PCRE2 versions before 10.48 contain an out-of-bounds read in pcre2_match that is reachable after a JIT match attempt falls back to the interpreter when the subject contains invalid UTF. The flaw is a local, high-complexity memory-safety bug with availability-only impact: a crash or process abort in the matching application. Confidentiality and integrity are not affected per the assigned scoring.

Why it matters to the business

Operational risk is limited. The issue can disrupt applications that compile PCRE2 with JIT and UTF matching if they accept untrusted local input, causing a crash of the matching process rather than data theft or takeover. It is not listed in CISA KEV, is not associated with ransomware, and has a very low, flat EPSS (~0.0029). Public exploit code is reported as available, which slightly raises urgency for hosts that still ship unpatched Red Hat pcre2-main, but the local vector and high attack complexity keep enterprise-wide impact modest. Downstream products that embed PCRE2 inherit the crash risk until they consume 10.48 or later.

How an attack unfolds

An attacker who can already run code or feed data on the same host targets a process that uses PCRE2 JIT matching with UTF handling. They supply a subject containing invalid UTF so that the JIT path cannot complete and control falls back into pcre2_match. That fallback reads outside the intended buffer and typically aborts the process. Because the vector is local and the required matching configuration (JIT plus UTF) plus invalid-UTF handling is uncommon, successful use is situational rather than mass-exploitable. Named APT or ransomware campaigns are not associated with this CVE.

How to fix it

Upgrade PCRE2 to 10.48 or later. On Red Hat pcre2-main, apply RHSA-2026:67534 and install pcre2-main 10.48-0.1.hum1 (or a later vendor build that includes 10.48). Rebuild or restart any statically linked or long-running consumers of libpcre2 so they load the patched library. If an immediate upgrade is not possible, disable JIT for untrusted input, reject invalid UTF before matching, or avoid feeding untrusted local data into pcre2_match until the patch is in place.

How to confirm the fix worked

Confirm the installed PCRE2 is 10.48 or newer (rpm -q pcre2 / package changelog showing RHSA-2026:67534 and 10.48-0.1.hum1). Verify running processes have mapped the patched libpcre2 (not a pre-10.48 copy) and that services were restarted after the upgrade. Regression-test regex paths that use JIT and UTF so they no longer crash on invalid UTF subjects. Inventory statically linked binaries and containers that may still embed an old PCRE2.

Typical attack path

1. Identify a local process that links PCRE2 before 10.48 with JIT and UTF matching enabled.
2. Supply a regex subject that contains invalid UTF so JIT matching fails over to the interpreter.
3. Trigger pcre2_match on that subject, causing an out-of-bounds read.
4. Induce a crash or abort of the matching process (denial of service).

How to detect it

Look for process crashes and coredumps whose stacks include pcre2_match or libpcre2, especially after JIT fallback, on hosts still running PCRE2 before 10.48. Review application logs around regex matching of untrusted local input, syslog/journal abort records, and crash reporters (systemd-coredump, ABRT, apport). There is no known remote beacon or campaign infrastructure for this CVE; detection is crash- and library-version-centric rather than network-IOC-centric. Correlate crashes with package versions below 10.48 and with workloads that enable PCRE2 JIT plus UTF.

• pcre2_match
• libpcre2.so
• libpcre2-8.so
• PCRE2 JIT
• invalid UTF
• pcre2 < 10.48
• pcre2-10.4
• pcre2-10.3
• pcre2-10.2
• RHSA-2026:67534

What your security team should do

• Patch Red Hat pcre2-main to 10.48-0.1.hum1 via RHSA-2026:67534 and restart consumers.
• Inventory hosts and images for PCRE2 < 10.48, including statically linked copies.
• Treat remaining unpatched local regex services as crash-risk, not remote RCE; prioritize internet-facing or multi-tenant matchers that accept untrusted input.
• If patching lags, disable JIT or enforce valid UTF on untrusted match inputs.
• Because exploit code is reported available, watch for crash spikes in pcre2_match even though EPSS and KEV status remain low.